In Linux distributions login passwords are commonly hashed and stored in the {{Filename|/etc/shadow}} file using the [[Wikipedia:MD5|MD5 algorithm]]. The security of the MD5 hash function has been severely compromised by [[Wikipedia:MD5#Collision_vulnerabilities|collision vulnerabilities]]. This does not mean MD5 is insecure for password hashing but in the interest of decreasing vulnerabilities a more secure and robust algorithm that has no known weaknesses (e.g. SHA-512) is recommended.

In Linux distributions login passwords are commonly hashed and stored in the {{Filename|/etc/shadow}} file using the [[Wikipedia:MD5|MD5 algorithm]]. The security of the MD5 hash function has been severely compromised by [[Wikipedia:MD5#Collision_vulnerabilities|collision vulnerabilities]]. This does not mean MD5 is insecure for password hashing but in the interest of decreasing vulnerabilities a more secure and robust algorithm that has no known weaknesses (e.g. SHA-512) is recommended.

Contents

Benefits of SHA-2 over MD5

In Linux distributions login passwords are commonly hashed and stored in the Template:Filename file using the MD5 algorithm. The security of the MD5 hash function has been severely compromised by collision vulnerabilities. This does not mean MD5 is insecure for password hashing but in the interest of decreasing vulnerabilities a more secure and robust algorithm that has no known weaknesses (e.g. SHA-512) is recommended.

Note: With shadow 4.1.4.3-3 sha512 is the default for new passwords (see bug 13591 and corresponding commit).

The following tutorial uses the sha512 hash function, which has been recommended by the NSA for Red Hat Enterprise Linux 5. Alternatively, SHA-2 consists of three additional hash functions with digests that are 224, 256 or 384 bits.

Support

Warning: The very minimal terminal manager fgetty does not support sha512 password hashing by default. Enabling sha512 with the default fgetty will cause you to be locked out.

Arch Linux's default tty manager agetty and the minimal tty manager mingetty both support sha512. Additionally, a patched version of fgetty in the AUR adds sha512 support.

Editing the Necessary Files

Note: You must have root privileges to edit the files within this section.

The rounds=N option helps to improve key strengthening. The number of rounds has a larger impact on security than the selection of a hash function. For example, rounds=65536 means that an attacker has to compute 65536 hashes for each password he tests against the hash in your Template:Filename. Therefore the attacker will be delayed by a factor of 65536. This also means that your computer must compute 65536 hashes every time you log in, but even on slow computers that takes less than 1 second. If you do not use the rounds option then glibc will default to 5000 rounds for sha512. Additionally, the default value for the rounds option can be found in Template:Filename.

Editing /etc/default/passwd

# This file contains some information for
# the passwd (1) command and other tools
# creating or modifying passwords.
# Define default crypt hash
# CRYPT={des,md5,blowfish}
CRYPT=des
# Use another crypt hash for group passwowrds.
# This is used by gpasswd, fallback is the CRYPT entry.
# GROUP_CRYPT=des
# We can override the default for a special service
# by appending the service name (FILES, YP, NISPLUS, LDAP)
# for local files, use a more secure hash. We
# do not need to be portable here:
CRYPT_FILES=blowfish
# sometimes we need to specify special options for
# a hash (variable is prepended by the name of the
# crypt hash).
BLOWFISH_CRYPT_FILES=5
# For NIS, we should always use DES:
CRYPT_YP=des

On line 7 of the above example file, change

CRYPT=des

to

CRYPT=sha512

Note: It is unclear whether this is still necessary with the Template:Filename mechanism.